What breaks when organisations assume ransomware actors will only use technical intrusion methods?

Why This Matters for Security Teams

Assuming ransomware actors will only rely on exploits creates a dangerous blind spot: modern crews frequently start with account takeover, social engineering, and abused help desk workflows, then move into privilege escalation and lateral access. That matters because the initial foothold can look like legitimate activity until encryption or exfiltration begins. NHI Mgmt Group has repeatedly shown how identity compromise and weak secrets handling widen the blast radius, with 80% of identity breaches involving compromised non-human identities such as service accounts and API keys in its Ultimate Guide to NHIs.

Public reporting on incidents such as the MGM Resorts Breach 2023 — Scattered Spider and the Caesars Entertainment Breach 2023 — Scattered Spider shows why this is not a theoretical issue. Attackers increasingly blend human manipulation with identity abuse, so endpoint-only and perimeter-only thinking misses the earliest, cheapest stage of the intrusion. Current guidance from ENISA Threat Landscape reinforces that ransomware is now as much an identity and access problem as a malware problem. In practice, many security teams encounter the real intrusion only after a help desk reset or token theft has already made containment harder.

How It Works in Practice

Effective defence starts by treating ransomware as a campaign, not a single payload. The first control point is identity workflow: phishing-resistant MFA, strict verification for password resets, and step-up checks for privileged changes. The second is secrets hygiene: rotate credentials quickly, remove long-lived tokens, and monitor for abnormal use of API keys, service accounts, and remote access tools. The third is privilege containment: least privilege, just-in-time elevation, and segmentation so that one stolen account cannot reach backup systems, hypervisors, or admin consoles.

Security teams should also use telemetry that reflects identity abuse, not just malware execution. That means correlating impossible travel, atypical token issuance, help desk escalations, new device enrollment, and unusual use of admin utilities. NIST’s Security and Privacy Controls provide useful anchors for access control, incident response, and audit logging, while the Ultimate Guide to NHIs highlights how weak rotation and poor visibility leave organisations exposed long before ransomware appears. In a mature programme, identity signals are treated as first-class intrusion indicators alongside endpoint detections.

• Harden service desk procedures so password resets cannot be used as an attack shortcut.
• Enforce short-lived credentials and revoke stale secrets on schedule, not after compromise.
• Separate user, admin, and recovery paths so one workflow cannot unlock all three.
• Alert on privilege changes, token replay, and abnormal access to backup or recovery systems.

These controls tend to break down in decentralised environments where many business units manage their own identity workflows because attackers can target the weakest local process and pivot across shared tooling.

Common Variations and Edge Cases

Tighter identity controls often increase operational overhead, requiring organisations to balance faster support and user convenience against stronger verification and lower blast radius. That tradeoff becomes more visible in environments with outsourced service desks, global operations, or heavy third-party access, where attackers can exploit inconsistent procedures across regions and vendors. The same is true when legacy systems cannot support modern MFA or short-lived tokens, forcing compensating controls rather than ideal ones.

Best practice is evolving, but current guidance suggests prioritising the pathways ransomware crews exploit most often: remote access, privileged support, backup administration, and any account that can create more accounts. The Ultimate Guide to NHIs notes that 97% of NHIs carry excessive privileges, which is exactly the kind of condition that turns one stolen credential into a platform-wide incident. For broader threat context, ENISA Threat Landscape remains useful for understanding how social engineering, credential theft, and ransomware converge.

Where this guidance is least reliable is in highly automated environments with shared administrative tooling, because one compromised identity can trigger rapid, machine-speed propagation before human responders can validate the change.

Related resources from NHI Mgmt Group

• What breaks when organisations rely on acceptable-use policies instead of technical controls for AI data privacy?
• What breaks when organisations use human IGA for non-human identities?
• What breaks when organisations use one Azure identity pattern for every workload?
• What breaks when organisations use fast general-purpose hashes for password storage?